Securety History

Hi all,

 

I have been seeing this security block appear quite often and it's starting to concern me. The sercurity block is listed below, it was copied and paste fron the security history  log.

 

____________

Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
11/10/2013 8:31:54 PM,Medium,Unauthorized access blocked (Access Process Data),Blocked,No Action Required,11/10/2013 8:31:54 PM,C:\WINDOWS\SYSWOW64\WBEM\WMIPRVSE.EXE,2288,C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe,1876,Access Process Data,Unauthorized access blocked

_____________

 

Should I be concerned about this?

 

 

Hi Bob_Eyster,

 

No, you should not be concerned about this.  The process is Windows Management Instrumentation, a legitimate Windows process.  The only mischief it got into was that it tried to access Norton process data, and Norton Product Tamper Protection blocked access, as it would block any similar attempt by any outside agent.  Tamper Protection merely isolates Norton from any outside interference (even from Windows itself), and is not an indicator of malicious activity.  If the process in question were truly malicious, Norton would remove it, rather than just quietly logging only its Norton-related activities.  I would be curious to know the source of the information given earlier that the entry is classified as malware.


SendOfJive wrote:

Hi Bob_Eyster,

 

No, you should not be concerned about this.  The process is Windows Management Instrumentation, a legitimate Windows process.  The only mischief it got into was that it tried to access Norton process data, and Norton Product Tamper Protection blocked access, as it would block any similar attempt by any outside agent.  Tamper Protection merely isolates Norton from any outside interference (even from Windows itself), and is not an indicator of malicious activity.  If the process in question were truly malicious, Norton would remove it, rather than just quietly logging only its Norton-related activities.  I would be curious to know the source of the information given earlier that the entry is classified as malware.


Thanks for the info. I googled it and came up with alot of hit but none classified it as a threat.

 

Hi all,

 

I have been seeing this security block appear quite often and it's starting to concern me. The sercurity block is listed below, it was copied and paste fron the security history  log.

 

____________

Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
11/10/2013 8:31:54 PM,Medium,Unauthorized access blocked (Access Process Data),Blocked,No Action Required,11/10/2013 8:31:54 PM,C:\WINDOWS\SYSWOW64\WBEM\WMIPRVSE.EXE,2288,C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe,1876,Access Process Data,Unauthorized access blocked

_____________

 

Should I be concerned about this?